CVE-2026-41724: VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)

Synopsis

Stored cross-site scripting (XSS) in VMware Cloud Foundation Operations allows an authenticated attacker with low-level privileges to inject malicious scripts into policies, views, or text widgets. The injected script executes in the browser of any user who views the affected content, requiring that victim to take no deliberate action beyond normal use of the application. Successful exploitation gives the attacker the ability to perform administrative actions within the application on behalf of the victim, including reading sensitive data, modifying configuration, and disrupting service. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as VMware publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable application must be reachable over the network; an attacker submits the malicious payload through normal HTTP/S requests to the exposed web interface.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker only needs the ability to create policies, views, or text widgets within the application.

• Victim interactionRequired

  A logged-in user (typically an administrator) must browse to or render the page containing the injected script for the payload to execute in their browser session.

• Attack complexityDetail

  Attack complexity is low; no race conditions or special environmental configuration are required to deliver and store the malicious payload reliably.

Blast Radius

• Reads the victim's active session tokens, cookies, and any sensitive data rendered in the application UI at the time the script executes.
• Performs administrative actions within VMware Cloud Foundation Operations under the identity of the victim user, including modifying monitoring policies and configuration.
• Modifies or deletes views, dashboards, and text widgets, corrupting operational visibility for other users.
• Triggers disruptive in-application actions on behalf of the victim, such as altering alert thresholds or disabling monitoring components.